// AUTO-GENERATED by scripts/generate.ts from .generated-specs. Do not edit.
import * as S from "@distilled.cloud/core/schema";
import * as API from "@distilled.cloud/core/api";
import * as T from "../traits.ts";
import {
  CloudflareProtocol,
  CloudflarePaginatedProtocol,
  type CloudflareOpError,
  type CloudflareOpContext,
} from "../protocol.ts";
import { cloudflarePaginate, ResultInfo } from "../pagination.ts";
import { CloudflareError, CloudflareRateLimited } from "../errors.ts";
import * as Retry from "../retry.ts";

export type { CloudflareOpError, CloudflareOpContext };

/** Fallback camelCase→wire mapping for opaque content (mined from the distilled SDK). */
const KEY_DICTIONARY: Record<string, string | ReadonlyArray<string>> = {
  bundleMethod: "bundle_method",
  createdOn: "created_on",
  modifiedOn: "modified_on",
  privateIp: "private_ip",
  vnetId: "vnet_id",
};

export class Forbidden
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<Forbidden>()("Forbidden", {
      code: S.Number,
      message: S.String,
    }),
    [{ status: 403 }],
  ) {}

export class KeylessCertificateNotFound
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<KeylessCertificateNotFound>()(
      "KeylessCertificateNotFound",
      {
        code: S.Number,
        message: S.String,
      },
    ),
    [{ code: 1005, message: { includes: "Invalid or missing Keyless SSL" } }],
  ) {}

export class KeylessSslNotAvailable
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<KeylessSslNotAvailable>()(
      "KeylessSslNotAvailable",
      {
        code: S.Number,
        message: S.String,
      },
    ),
    [{ code: 1067, message: { includes: "Keyless SSL is not available" } }],
  ) {}

export type CreateRequestBundleMethod = "ubiquitous" | "optimal" | "force";
export const CreateRequestBundleMethod = /*@__PURE__*/ S.String;

export interface CreateRequestTunnel {
  /** Private IP of the Key Server Host. */
  privateIp: string;
  /** Cloudflare Tunnel Virtual Network ID. */
  vnetId: string;
}
export const CreateRequestTunnel = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    privateIp: S.String.pipe(T.Body("private_ip")),
    vnetId: S.String.pipe(T.Body("vnet_id")),
  }),
).annotate({
  identifier: "CreateRequestTunnel",
}) as any as S.Schema<CreateRequestTunnel>;

export interface CreateKeylessCertificateRequest {
  /** Identifier. */
  zoneId: string;
  /** The zone's SSL certificate or SSL certificate and intermediate(s). */
  certificate: string;
  /** The keyless SSL name. */
  host: string;
  /** The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server. */
  port: number;
  /** A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it. */
  bundleMethod?: CreateRequestBundleMethod | (string & {});
  /** The keyless SSL name. */
  name?: string;
  /** Configuration for using Keyless SSL through a Cloudflare Tunnel. */
  tunnel?: CreateRequestTunnel;
}
export const CreateKeylessCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    certificate: S.String,
    host: S.String,
    port: S.Number,
    bundleMethod: S.optional(
      CreateRequestBundleMethod.pipe(T.Body("bundle_method")),
    ),
    name: S.optional(S.String),
    tunnel: S.optional(CreateRequestTunnel),
  })
    .pipe(
      T.Http({
        method: "POST",
        uri: "/zones/{zone_id}/keyless_certificates",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "CreateKeylessCertificateRequest",
}) as any as S.Schema<CreateKeylessCertificateRequest>;

export type CreateResponsePermissionsList = Array<string>;
export const CreateResponsePermissionsList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<CreateResponsePermissionsList>;

export type CreateResponseStatus = "active" | "deleted";
export const CreateResponseStatus = /*@__PURE__*/ S.String;

export type CreateResponseTunnel = CreateRequestTunnel;
export const CreateResponseTunnel = CreateRequestTunnel;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface CreateKeylessCertificateResponse {
  /** Keyless certificate identifier tag. */
  id: string;
  /** When the Keyless SSL was created. */
  createdOn: string;
  /** Whether or not the Keyless SSL is on or off. */
  enabled: boolean;
  /** The keyless SSL name. */
  host: string;
  /** When the Keyless SSL was last modified. */
  modifiedOn: string;
  /** The keyless SSL name. */
  name: string;
  /** Available permissions for the Keyless SSL for the current user requesting the item. */
  permissions: CreateResponsePermissionsList;
  /** The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server. */
  port: number;
  /** Status of the Keyless SSL. */
  status: CreateResponseStatus;
  /** Configuration for using Keyless SSL through a Cloudflare Tunnel. */
  tunnel?: CreateRequestTunnel | null;
}
export const CreateKeylessCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.String,
    createdOn: S.String.pipe(T.Body("created_on")),
    enabled: S.Boolean,
    host: S.String,
    modifiedOn: S.String.pipe(T.Body("modified_on")),
    name: S.String,
    permissions: CreateResponsePermissionsList,
    port: S.Number,
    status: CreateResponseStatus,
    tunnel: S.optional(S.NullOr(CreateRequestTunnel)),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "CreateKeylessCertificateResponse",
}) as any as S.Schema<CreateKeylessCertificateResponse>;

export interface DeleteKeylessCertificateRequest {
  /** Identifier. */
  zoneId: string;
  /** Identifier. */
  keylessCertificateId: string;
}
export const DeleteKeylessCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    keylessCertificateId: S.String.pipe(T.Label("keyless_certificate_id")),
  })
    .pipe(
      T.Http({
        method: "DELETE",
        uri: "/zones/{zone_id}/keyless_certificates/{keyless_certificate_id}",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "DeleteKeylessCertificateRequest",
}) as any as S.Schema<DeleteKeylessCertificateRequest>;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface DeleteKeylessCertificateResponse {
  /** Identifier. */
  id?: string | null;
}
export const DeleteKeylessCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.optional(S.NullOr(S.String)),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "DeleteKeylessCertificateResponse",
}) as any as S.Schema<DeleteKeylessCertificateResponse>;

export interface GetKeylessCertificateRequest {
  /** Identifier. */
  zoneId: string;
  /** Identifier. */
  keylessCertificateId: string;
}
export const GetKeylessCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    keylessCertificateId: S.String.pipe(T.Label("keyless_certificate_id")),
  })
    .pipe(
      T.Http({
        method: "GET",
        uri: "/zones/{zone_id}/keyless_certificates/{keyless_certificate_id}",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "GetKeylessCertificateRequest",
}) as any as S.Schema<GetKeylessCertificateRequest>;

export type GetResponsePermissionsList = Array<string>;
export const GetResponsePermissionsList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<GetResponsePermissionsList>;

export type GetResponseStatus = "active" | "deleted";
export const GetResponseStatus = /*@__PURE__*/ S.String;

export type GetResponseTunnel = CreateRequestTunnel;
export const GetResponseTunnel = CreateRequestTunnel;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface GetKeylessCertificateResponse {
  /** Keyless certificate identifier tag. */
  id: string;
  /** When the Keyless SSL was created. */
  createdOn: string;
  /** Whether or not the Keyless SSL is on or off. */
  enabled: boolean;
  /** The keyless SSL name. */
  host: string;
  /** When the Keyless SSL was last modified. */
  modifiedOn: string;
  /** The keyless SSL name. */
  name: string;
  /** Available permissions for the Keyless SSL for the current user requesting the item. */
  permissions: GetResponsePermissionsList;
  /** The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server. */
  port: number;
  /** Status of the Keyless SSL. */
  status: GetResponseStatus;
  /** Configuration for using Keyless SSL through a Cloudflare Tunnel. */
  tunnel?: CreateRequestTunnel | null;
}
export const GetKeylessCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.String,
    createdOn: S.String.pipe(T.Body("created_on")),
    enabled: S.Boolean,
    host: S.String,
    modifiedOn: S.String.pipe(T.Body("modified_on")),
    name: S.String,
    permissions: GetResponsePermissionsList,
    port: S.Number,
    status: GetResponseStatus,
    tunnel: S.optional(S.NullOr(CreateRequestTunnel)),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "GetKeylessCertificateResponse",
}) as any as S.Schema<GetKeylessCertificateResponse>;

export interface ListKeylessCertificatesRequest {
  /** Identifier. */
  zoneId: string;
}
export const ListKeylessCertificatesRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
  })
    .pipe(
      T.Http({
        method: "GET",
        uri: "/zones/{zone_id}/keyless_certificates",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "ListKeylessCertificatesRequest",
}) as any as S.Schema<ListKeylessCertificatesRequest>;

export type ListResultItemPermissionsList = Array<string>;
export const ListResultItemPermissionsList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<ListResultItemPermissionsList>;

export type ListResultItemStatus = "active" | "deleted";
export const ListResultItemStatus = /*@__PURE__*/ S.String;

export type ListResultItemTunnel = CreateRequestTunnel;
export const ListResultItemTunnel = CreateRequestTunnel;

export interface ListResultItem {
  /** Keyless certificate identifier tag. */
  id: string;
  /** When the Keyless SSL was created. */
  createdOn: string;
  /** Whether or not the Keyless SSL is on or off. */
  enabled: boolean;
  /** The keyless SSL name. */
  host: string;
  /** When the Keyless SSL was last modified. */
  modifiedOn: string;
  /** The keyless SSL name. */
  name: string;
  /** Available permissions for the Keyless SSL for the current user requesting the item. */
  permissions: ListResultItemPermissionsList;
  /** The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server. */
  port: number;
  /** Status of the Keyless SSL. */
  status: ListResultItemStatus;
  /** Configuration for using Keyless SSL through a Cloudflare Tunnel. */
  tunnel?: CreateRequestTunnel | null;
}
export const ListResultItem = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.String,
    createdOn: S.String.pipe(T.Body("created_on")),
    enabled: S.Boolean,
    host: S.String,
    modifiedOn: S.String.pipe(T.Body("modified_on")),
    name: S.String,
    permissions: ListResultItemPermissionsList,
    port: S.Number,
    status: ListResultItemStatus,
    tunnel: S.optional(S.NullOr(CreateRequestTunnel)),
  }),
).annotate({ identifier: "ListResultItem" }) as any as S.Schema<ListResultItem>;

export type ListResultList = Array<ListResultItem>;
export const ListResultList = /*@__PURE__*/ S.Array(
  ListResultItem,
) as any as S.Schema<ListResultList>;

export interface ListKeylessCertificatesResponse {
  /** The unwrapped `result` payload of the v4 response envelope. */
  result: ListResultList;
  /** Pagination info from the envelope's `result_info`. */
  resultInfo?: ResultInfo | null;
}
export const ListKeylessCertificatesResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    result: ListResultList.pipe(T.EnvelopePayload()),
    resultInfo: S.optional(S.NullOr(ResultInfo).pipe(T.ResultInfo())),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "ListKeylessCertificatesResponse",
}) as any as S.Schema<ListKeylessCertificatesResponse>;

export type EditRequestTunnel = CreateRequestTunnel;
export const EditRequestTunnel = CreateRequestTunnel;

export interface PatchKeylessCertificateRequest {
  /** Identifier. */
  zoneId: string;
  /** Identifier. */
  keylessCertificateId: string;
  /** Whether or not the Keyless SSL is on or off. */
  enabled?: boolean;
  /** The keyless SSL name. */
  host?: string;
  /** The keyless SSL name. */
  name?: string;
  /** The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server. */
  port?: number;
  /** Configuration for using Keyless SSL through a Cloudflare Tunnel. */
  tunnel?: CreateRequestTunnel;
}
export const PatchKeylessCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    keylessCertificateId: S.String.pipe(T.Label("keyless_certificate_id")),
    enabled: S.optional(S.Boolean),
    host: S.optional(S.String),
    name: S.optional(S.String),
    port: S.optional(S.Number),
    tunnel: S.optional(CreateRequestTunnel),
  })
    .pipe(
      T.Http({
        method: "PATCH",
        uri: "/zones/{zone_id}/keyless_certificates/{keyless_certificate_id}",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "PatchKeylessCertificateRequest",
}) as any as S.Schema<PatchKeylessCertificateRequest>;

export type EditResponsePermissionsList = Array<string>;
export const EditResponsePermissionsList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<EditResponsePermissionsList>;

export type EditResponseStatus = "active" | "deleted";
export const EditResponseStatus = /*@__PURE__*/ S.String;

export type EditResponseTunnel = CreateRequestTunnel;
export const EditResponseTunnel = CreateRequestTunnel;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface PatchKeylessCertificateResponse {
  /** Keyless certificate identifier tag. */
  id: string;
  /** When the Keyless SSL was created. */
  createdOn: string;
  /** Whether or not the Keyless SSL is on or off. */
  enabled: boolean;
  /** The keyless SSL name. */
  host: string;
  /** When the Keyless SSL was last modified. */
  modifiedOn: string;
  /** The keyless SSL name. */
  name: string;
  /** Available permissions for the Keyless SSL for the current user requesting the item. */
  permissions: EditResponsePermissionsList;
  /** The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server. */
  port: number;
  /** Status of the Keyless SSL. */
  status: EditResponseStatus;
  /** Configuration for using Keyless SSL through a Cloudflare Tunnel. */
  tunnel?: CreateRequestTunnel | null;
}
export const PatchKeylessCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.String,
    createdOn: S.String.pipe(T.Body("created_on")),
    enabled: S.Boolean,
    host: S.String,
    modifiedOn: S.String.pipe(T.Body("modified_on")),
    name: S.String,
    permissions: EditResponsePermissionsList,
    port: S.Number,
    status: EditResponseStatus,
    tunnel: S.optional(S.NullOr(CreateRequestTunnel)),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "PatchKeylessCertificateResponse",
}) as any as S.Schema<PatchKeylessCertificateResponse>;

export type CreateKeylessCertificateError =
  | KeylessSslNotAvailable
  | Forbidden
  | CloudflareOpError;
/** Creates a Keyless SSL configuration that allows SSL/TLS termination without exposing private keys to Cloudflare. Keys remain on your infrastructure. */
export const createKeylessCertificate: API.OperationMethod<
  CreateKeylessCertificateRequest,
  CreateKeylessCertificateResponse,
  CreateKeylessCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: CreateKeylessCertificateRequest,
  output: CreateKeylessCertificateResponse,
  errors: [
    KeylessSslNotAvailable,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type DeleteKeylessCertificateError =
  | KeylessCertificateNotFound
  | Forbidden
  | CloudflareOpError;
/** Removes a Keyless SSL configuration. SSL connections will no longer use the keyless server for cryptographic operations. */
export const deleteKeylessCertificate: API.OperationMethod<
  DeleteKeylessCertificateRequest,
  DeleteKeylessCertificateResponse,
  DeleteKeylessCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: DeleteKeylessCertificateRequest,
  output: DeleteKeylessCertificateResponse,
  errors: [
    KeylessCertificateNotFound,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type GetKeylessCertificateError =
  | KeylessCertificateNotFound
  | Forbidden
  | CloudflareOpError;
/** Get details for one Keyless SSL configuration. */
export const getKeylessCertificate: API.OperationMethod<
  GetKeylessCertificateRequest,
  GetKeylessCertificateResponse,
  GetKeylessCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: GetKeylessCertificateRequest,
  output: GetKeylessCertificateResponse,
  errors: [
    KeylessCertificateNotFound,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type ListKeylessCertificatesError = Forbidden | CloudflareOpError;
/** List all Keyless SSL configurations for a given zone. */
export const listKeylessCertificates: API.PaginatedOperationMethod<
  ListKeylessCertificatesRequest,
  ListKeylessCertificatesResponse,
  ListKeylessCertificatesError,
  CloudflareOpContext,
  ListResultItem
> = /*@__PURE__*/ API.makePaginated(
  () => ({
    input: ListKeylessCertificatesRequest,
    output: ListKeylessCertificatesResponse,
    errors: [Forbidden, CloudflareRateLimited, CloudflareError],
    protocol: CloudflarePaginatedProtocol,
    retry: Retry.Retry,
    pagination: { mode: "single", items: "result" } as const,
  }),
  cloudflarePaginate,
) as any;

export type PatchKeylessCertificateError =
  | KeylessCertificateNotFound
  | Forbidden
  | CloudflareOpError;
/** This will update attributes of a Keyless SSL. Consists of one or more of the following: host,name,port. */
export const patchKeylessCertificate: API.OperationMethod<
  PatchKeylessCertificateRequest,
  PatchKeylessCertificateResponse,
  PatchKeylessCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: PatchKeylessCertificateRequest,
  output: PatchKeylessCertificateResponse,
  errors: [
    KeylessCertificateNotFound,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));